Security problem

[shranet]

Hi. Sorry my english bad.
If you are using connector PHP, then you can get access to the parent folder as follows (on v0.8):

---

On current version:
If file manager files are in “fm” folder, then:

---

[simogeo]

I edited your message to protect FM users.
I'll fix it very soon. If any recommendation to do it the clean way, please send me an email. See my email in PHP connector code source.

Thanks for spotting this !

[simogeo]

Please see a204411, and test it ! Thanks to shranet & Joakim

[hammond13]

Just a note that I handled this in the mvc connector by passing all operations through an IsInRootPath function.
https://github.com/simogeo/Filemanager/blob/master/connectors/mvc/FilemanagerController.cs#L130

[simogeo]

@hammond13 : thanks for precision.